Security audit

rh-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real RunningHub media-generation helper, but it asks users to run unpinned external code during setup and does not clearly explain cloud data sharing.

Review before installing. Prefer a pinned, audited RHMCP commit or release, install/build it in a sandbox or low-privilege environment, and do not expose production credentials during npm install/build. Treat prompts, image URLs, and uploaded media as data sent to RunningHub or related infrastructure, and avoid submitting private or sensitive content unless that is approved.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned Remote Dependency Installation Allows Supply-Chain Code Execution
Content: View full analysis
Remediation: View remediation
``` 2. Publish immutable, versioned releases and document the exact supported release and commit. 3. Provide cryptographic checksums or signed release artifacts, and require users to verify them before installation. 4. Commit and review an npm lockfile in the upstream project. Use deterministic installation: ```bash npm ci ``` 5. Audit direct and transitive dependencies, including all npm lifecycle scripts, before approving a version. 6. Where operationally possible, initially install dependencies with lifecycle scripts disabled: ```bash npm ci --ignore-scripts ``` Run only specifically reviewed build steps afterward. This option must be tested because some legitimate dependencies may require installation scripts. 7. Perform installation and builds in a sandbox, container, or dedicated low-privilege account without access to production credentials or sensitive user files. 8. Avoid exposing `RUNNINGHUB_API_KEY` or other secrets to dependency installation and build processes unless strictly required. 9. Update both `SKILL.md` and `README.md` so that all installation examples consistently use the same pinned and verified version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README shows examples where user prompts are sent to RunningHub-backed apps and image URLs are returned, but it does not clearly disclose that user input and possibly referenced media will be transmitted to an external cloud AI service and that returned URLs may point to external infrastructure. In an agent skill context, this omission can mislead operators about data handling and trust boundaries, increasing privacy, compliance, and content-safety risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares required environment/config inputs but does not define an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege boundaries and makes it harder for the agent runtime or reviewer to constrain what the skill may access or invoke, increasing the chance of unintended capability exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill content, headings, examples, and operational guidance are entirely written in Chinese, while the file does not indicate that the skill is region-specific or provide user opt-in for language/locale. Under SQP-3, forcing a specific language without user choice can violate language or locale policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly supports uploading media and passing user-supplied images/URLs to remote apps, but it does not warn that user content will be sent to third-party services or explain privacy implications. This can lead to unconsented external data transfer, especially for sensitive images, prompts, or hosted URLs containing personal or internal information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The sceneMapping list includes very broad natural-language triggers such as “生成图片”, “画一张图”, and “画画”, which can match ordinary user phrasing without strong intent validation. In a skill that can invoke external image-generation workflows, ambiguous routing can cause unintended tool activation, unnecessary external data transmission, or execution of the wrong app flow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The sceneIndex maps broad phrases like “改图” and “修改图片” directly to the image-to-image app, which may route routine conversational requests into an image-editing action without sufficient confirmation. Because this skill is specifically designed to call RunningHub AI apps, ambiguous triggers are more dangerous here than in a passive reference file: they can lead to unintended processing of user-supplied image URLs or prompt content by an external service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This JSON template file contains user-facing names, style hints, example prompts, and tags entirely in Chinese. Because the file does not indicate that the skill is region-specific or provide any user language choice, it may violate the policy against forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code's natural-language interface is presented entirely in Chinese, including the header description and usage guidance, with no indication that users can opt into another language. Under the policy, forcing a specific language without user choice is a locale-policy concern unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: User-facing errors, command descriptions, examples, and environment-variable guidance are emitted only in Chinese. This creates a language-policy issue because the skill forces one locale in its interactive output without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: 文件标题和简介直接将技能限定为“OpenClaw 专用”，并全文仅以中文呈现，没有说明是否支持其他语言/locale 或这是平台特定集成文档。按规则，强制单一语言/locale 而无用户选择或合理说明，可能构成自然语言层面的组织策略问题。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The executor loads JSON configuration from paths influenced by RHMCP_CONFIG and process.cwd(), allowing the skill to read arbitrary local files named service.json or apps.json outside a tightly scoped application directory. In a skill intended to help select media-generation apps, this broad local file access is unnecessary and could expose or trust unintended local configuration if the environment or working directory is manipulated.
Content: No source excerpt is available for this finding.